EUVD-2026-66217
GHSA-fcv9-h6ph-8mrc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects required teamlead authentication; AV:N for REST API access; no subsequent-system impact (SC/SI/SA:N) as the flaw does not propagate beyond Kimai's own team data.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all existing team members before validating the submitted replacement member list. An authenticated teamlead (or other user) with permission to edit a team can submit a malformed members payload; although Kimai returns a validation error, the existing membership rows have already been deleted. This bypasses the dedicated member-removal endpoint's protection against removing teamleaders and can leave a team with no members or teamleaders, disrupting team-based access control.
AnalysisAI
Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from any team they can edit by exploiting a non-atomic delete-before-validate workflow in the PATCH /api/teams/{id} endpoint. The endpoint deletes all existing member rows before completing validation of the replacement list; when a malformed payload triggers a validation error, the deletion is not rolled back, leaving teams with no members or teamleaders and collapsing team-based access control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Kimai account holding the teamlead role or equivalent permission to edit the target team, corresponding to PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H scores 8.7, reflecting a network-reachable attack requiring only a low-privilege teamlead account and no special conditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Kimai teamlead crafts a PATCH /api/teams/{id} request that references non-existent or invalid user IDs in the members array. Kimai immediately deletes all current team member rows, then fails input validation and returns an HTTP error-leaving the team permanently empty, with no members and no teamleaders. … |
| Remediation | Upgrade to Kimai 2.63.0 or later, which resolves the non-atomic delete-before-validate logic in the team update endpoint; the fix is documented in the vendor advisory at https://github.com/kimai/kimai/security/advisories/GHSA-6rxf-4hh9-pp46. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Kimai deployments and audit team lead account assignments; restrict team lead privileges to essential administrators only and implement approval requirements for team modifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Kimai is a web-based multi-user time-tracking application. Rated high severity (CVSS 7.2), this vulnerability is remotel
Kimai versions prior to 2.46.0 contain an overly permissive Twig sandbox configuration in the export functionality that
Kimai versions prior to 2.51.0 lack proper customer-level access controls in the invoice API endpoint, allowing any user
Kimai is a web-based multi-user time-tracking application. Rated medium severity (CVSS 6.5), this vulnerability is remot
Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into
Authorization bypass in the Kimai open-source time-tracking application before 2.56.0 lets any authenticated user holdin
Password reset links in Kimai before 2.58.0 function as persistent authentication credentials because the LoginLink HMAC
Unauthorized project report export in Kimai before 2.64.0 allows any authenticated user, regardless of role, to download
Cross-user bookmark tampering in Kimai versions before 2.57.0 allows any authenticated low-privileged user to inject or
Kimai's Twig sandbox exposes server-wide secrets through an unrestricted config() function in administrator-uploaded inv
Authorization bypass in Kimai's QuickEntry controller allows authenticated network users holding view_other_timesheet an
A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Rated medium severity (CVSS 6.5), this vu
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today